Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Hackers Give ChatGPT Users 48 Hours to “Update Payment” in Credential-Stealing Phishing Attack
Malware Families
Excerpt
Threat actors are targeting ChatGPT users with fake subscription-payment emails that create urgency and direct victims to credential-stealing websites. The phishing campaign, identified by Cofense’s Phishing Defense Center (PDC), impersonates OpenAI and warns recipients that they must update their payment details within 48 hours. The emails are designed to target both personal and work users of ChatGPT, especially those who may have paid subscriptions or expect billing…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | nxcli.io | High | Score 58/100 | First seen |
| support@9527db6e1a.nxcli.io | High | Score 62/100 | First seen |
IOC Relationship Graph
Building graph…